Websocket handshake manipulation

Question

In order to create a websocket connection in javascript we can use the websocket api for example:

const socket = new WebSocket('ws://localhost:8080');

then the browser will initiate an handshake via http get request with those headers:

Upgrade: websocket
Connection: Upgrade

and the server response :

HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Accept: s3pPLMBiTxaQ9kYGzzhZRbK+xOo=

after that the client and server will have websocket connection opened.

So my question is if it's possible to do the handshake on other methods ? and if it's possible to take care of the handshake via javascript like xhr or something like that?

Community · Accepted Answer · 2021-10-07 11:10:55Z

1

The WebSockets handshake is only defined with GET, see the standard. Also, since WebSockets do not fit into the request-response scheme of HTTP but essentially build a permanent connection where both server and client can write independently from each other there is no way to deal with WebSockets using XHR which expects a single response to a single request.

edited Oct 7, 2021 at 11:10

CommunityBot

11 silver badge

answered May 6, 2018 at 15:43

Steffen Ullrich

125k11 gold badges155 silver badges194 bronze badges

Sign up to request clarification or add additional context in comments.

10 Comments

avi dahan Over a year ago

I can't hook that get request and fake a response via javascript? i would like the websocket to start the connection without the handshake and any protocol violation can be dealt with on the server side

Steffen Ullrich Over a year ago

@avidahan: there is no "no handshake" with websockets. What you essentially would need is access to plain TCP sockets and then you could do your own protocol. But this would have nothing to do with WebSockets, i.e. WebSockets are not plain TCP sockets but only look a lot like this from outside.

Remy Lebeau Over a year ago

@avidahan what are you REALLY trying to accomplish? It sounds like you are trying to abuse WebSockets for something they are not intended for.

avi dahan Over a year ago

@RemyLebeau If using websocket without a proper handshake called abusing than yes I am trying to abuse it, it seems do that it’s not possible

Remy Lebeau Over a year ago

@avidahan but WHY do you want this? What is your GOAL?

|

Collectives™ on Stack Overflow

Websocket handshake manipulation

1 Answer 1

10 Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

10 Comments

Related